[PATCH v5 0/3] vhost: fix device IOTLB feature lifecycle

[PATCH v5 0/3] vhost: fix device IOTLB feature lifecycle

[Jia Jia]

Both vhost-vsock and vhost-net can leave the device IOTLB attached when
userspace clears VIRTIO_F_ACCESS_PLATFORM. They also replace an existing
IOTLB with a new empty table when a later feature update keeps
ACCESS_PLATFORM enabled, for example when updating logging.

The stale IOTLB can keep old translations active after a memory table
change, while replacing an existing table discards valid translations and
causes avoidable IOTLB misses.

Patch 1 makes device IOTLB initialization idempotent and adds a common
teardown helper. The helper detaches the table from every virtqueue,
resets metadata caches, clears queued IOTLB miss messages, and frees the
old table after the virtqueue handoff. It is a no-op when no device IOTLB
is installed.

Patches 2 and 3 use the common helper when vhost-vsock and vhost-net clear
ACCESS_PLATFORM. The backend-specific code continues to update
acked_features in its own virtqueue loop.

Changes since v4:
- move the existing-IOTLB check into vhost_init_device_iotlb()
- remove the vhost-vsock-specific keep-IOTLB patch
- add the corresponding ACCESS_PLATFORM teardown to vhost-net
- make vhost_clear_device_iotlb() handle an absent device IOTLB

Jia Jia (3):
  vhost: add helpers for device IOTLB lifecycle
  vhost/vsock: discard IOTLB when ACCESS_PLATFORM is cleared
  vhost/net: discard IOTLB when ACCESS_PLATFORM is cleared

 drivers/vhost/net.c   |  4 ++++
 drivers/vhost/vhost.c | 28 ++++++++++++++++++++++++++++
 drivers/vhost/vhost.h |  1 +
 drivers/vhost/vsock.c |  4 ++++
 4 files changed, 36 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH v5 1/3] vhost: add helpers for device IOTLB lifecycle

[Jia Jia]

vhost_init_device_iotlb() currently replaces an existing device IOTLB
with a new empty table. A later VHOST_SET_FEATURES update, such as a
logging change while ACCESS_PLATFORM remains enabled, can therefore
discard valid translations.

Make device IOTLB initialization idempotent and add a common teardown
helper for the inverse transition. The helper detaches the table from
all virtqueues, resets their metadata caches, clears queued IOTLB miss
messages, and frees the old table after the virtqueue handoff. It is a
no-op when no device IOTLB is installed, so callers do not need to inspect
that internal state.

Callers must hold the device mutex. The helper does not update
acknowledged features; backend-specific code continues to do that.

Fixes: 6b1e6cc7855b ("vhost: new device IOTLB API")
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
 drivers/vhost/vhost.c | 30 ++++++++++++++++++++++++++++++
 drivers/vhost/vhost.h |  1 +
 2 files changed, 31 insertions(+)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index cda5c350d9be..61676987ad58 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2451,6 +2451,32 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
 }
 EXPORT_SYMBOL_GPL(vhost_vring_ioctl);
 
+/* Caller must hold the device mutex. */
+void vhost_clear_device_iotlb(struct vhost_dev *d)
+{
+	struct vhost_iotlb *iotlb;
+	int i;
+
+	iotlb = d->iotlb;
+	if (!iotlb)
+		return;
+	d->iotlb = NULL;
+
+	for (i = 0; i < d->nvqs; ++i) {
+		struct vhost_virtqueue *vq = d->vqs[i];
+
+		mutex_lock(&vq->mutex);
+		vq->iotlb = NULL;
+		__vhost_vq_meta_reset(vq);
+		mutex_unlock(&vq->mutex);
+	}
+
+	vhost_clear_msg(d);
+	vhost_iotlb_free(iotlb);
+	wake_up_interruptible_poll(&d->wait, EPOLLIN | EPOLLRDNORM);
+}
+EXPORT_SYMBOL_GPL(vhost_clear_device_iotlb);
+
 static bool vhost_retry_iotlb_misses(struct vhost_dev *d)
 {
 	bool wake = false;
@@ -2475,12 +2501,16 @@ static bool vhost_retry_iotlb_misses(struct vhost_dev *d)
 	return wake;
 }
 
+/* Caller must hold the device mutex. */
 int vhost_init_device_iotlb(struct vhost_dev *d)
 {
 	struct vhost_iotlb *niotlb, *oiotlb;
 	bool wake;
 	int i;
 
+	if (d->iotlb)
+		return 0;
+
 	niotlb = iotlb_alloc();
 	if (!niotlb)
 		return -ENOMEM;
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 50fccc85d594..a3c598a79251 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -283,6 +283,7 @@ ssize_t vhost_chr_read_iter(struct vhost_dev *dev, struct iov_iter *to,
 			    int noblock);
 ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
 			     struct iov_iter *from);
+void vhost_clear_device_iotlb(struct vhost_dev *d);
 int vhost_init_device_iotlb(struct vhost_dev *d);
 
 void vhost_iotlb_map_free(struct vhost_iotlb *iotlb,

[PATCH v5 2/3] vhost/vsock: discard IOTLB when ACCESS_PLATFORM is cleared

[Jia Jia]

vhost_vsock_set_features() currently leaves the device IOTLB
attached when userspace clears VIRTIO_F_ACCESS_PLATFORM. Descriptor
translation can therefore continue to use mappings installed before the
feature change, including HVAs made stale by a later memory table update.

Use the common vhost helper when ACCESS_PLATFORM is absent. The helper
handles the no-IOTLB case internally, while the common initializer keeps
an existing IOTLB when ACCESS_PLATFORM remains enabled across a feature
update.

Fixes: e13a6915a03f ("vhost/vsock: add IOTLB API support")
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
 drivers/vhost/vsock.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 1d8ec6bed53e..1a61d7db7605 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -849,10 +849,11 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features)
 		goto err;
 	}
 
-	if ((features & (1ULL << VIRTIO_F_ACCESS_PLATFORM))) {
+	if (features & (1ULL << VIRTIO_F_ACCESS_PLATFORM)) {
 		if (vhost_init_device_iotlb(&vsock->dev))
 			goto err;
-	}
+	} else
+		vhost_clear_device_iotlb(&vsock->dev);
 
 	vsock->seqpacket_allow = features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET);
 

[PATCH v5 3/3] vhost/net: discard IOTLB when ACCESS_PLATFORM is cleared

[Jia Jia]

vhost_net_set_features() leaves the device IOTLB attached when
userspace clears VIRTIO_F_ACCESS_PLATFORM. Later descriptor translation
can therefore continue to use translations from the old IOTLB after the
userspace memory table has changed.

Use the common vhost helper when ACCESS_PLATFORM is absent. The helper
handles the no-IOTLB case internally, while the common initializer also
keeps an existing IOTLB when a feature update retains ACCESS_PLATFORM, so
logging updates do not discard valid translations.

Fixes: 6b1e6cc7855b ("vhost: new device IOTLB API")
Link: https://lore.kernel.org/all/20260726141158.1652386-1-physicalmtea@gmail.com/
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
 drivers/vhost/net.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index c6536cad9c4f..8d6f530f49b3 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1687,7 +1687,8 @@ static int vhost_net_set_features(struct vhost_net *n, const u64 *features)
 	if (virtio_features_test_bit(features, VIRTIO_F_ACCESS_PLATFORM)) {
 		if (vhost_init_device_iotlb(&n->dev))
 			goto out_unlock;
-	}
+	} else
+		vhost_clear_device_iotlb(&n->dev);
 
 	for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
 		mutex_lock(&n->vqs[i].vq.mutex);